Scheduled Tasks (sec-cron)

Monitors cron jobs (Linux) and scheduled tasks (Windows) for changes, suspicious paths, and insecure permissions.

Configuration

ParameterTypeDefaultDescription
enabledbooltrueEnable/disable module
check_systemd_timersbooltrueCheck systemd timers (Linux only)
suspicious_pathslist["/tmp", "/var/tmp", "/dev/shm"]Suspicious directories in tasks
ignore_userslist["root"]Ignore user crontabs

YAML Example

sec_cron:
  enabled: true
  check_systemd_timers: true
  suspicious_paths:
    - "/tmp"
    - "/var/tmp"
    - "/dev/shm"
  ignore_users:
    - "root"
    - "www-data"

Diagnostic Codes

Linux

CodeSeverityMeaningRecommendation
71000No issues detected—
71011System crontab added/modifiedVerify change
71021User crontab modifiedVerify change
71031Systemd timer modifiedVerify change
71042Cron file is world-writableRestrict permissions
71052Suspicious path in cron jobInvestigate task, possible persistence

Windows

CodeSeverityMeaningRecommendation
81000No issues detected—
81011New scheduled task detectedVerify task
81021Scheduled task modifiedVerify change
81032Suspicious path in taskInvestigate task
81041Task running under unexpected identityReview service account
81051Task removed from baselineVerify removal

Platform Support

  • Linux: Checks /etc/cron.*, user crontabs, and systemd timers.
  • Windows: Checks scheduled tasks via schtasks and PowerShell.